denniswon

Vulnerability Report: Missing Ownership Verification in PolicyClientRegistry.registerClient

Executive Summary

The PolicyClientRegistry.registerClient function lacks verification that the caller is the actual owner of the policy client being registered. This allows any address to register as the "registry owner" of any INewtonPolicyClient contract, enabling them to control the client's active status and block identity linking operations in the dependent IdentityRegistry.

Vulnerability Details

Location

denniswon

Vulnerability Report: Non-Canonical EIP-712 Array Encoding in IdentityRegistry

Executive Summary

The IdentityRegistry contract contains a critical encoding flaw in its EIP-712 signature verification logic. The contract hashes bytes32[] arrays using abi.encode() instead of the canonical EIP-712 specification requiring abi.encodePacked(). This mismatch causes all standard EIP-712 signatures to fail verification, completely breaking the signature-based identity linking functionality.

Vulnerability Details

Location

denniswon

Vulnerability Report: Frozen Funds Due to Incorrect transferFrom Usage in Withdrawal Function

Executive Summary

The NewtonPersonalVault contract contains a critical flaw in its _withdraw function that renders all post-expiration withdrawals impossible. The function incorrectly uses transferFrom instead of transfer when moving tokens from the vault to the beneficiary, requiring a self-allowance that is never set and cannot be set after expiration.

Vulnerability Details

Location

denniswon

Vulnerability Report: Flawed Challenge Logic in challengeDirectlyVerifiedMismatch Enables Illegitimate Operator Slashing

Executive Summary

The challengeDirectlyVerifiedMismatch function in ChallengeVerifier.sol contains multiple critical flaws that enable illegitimate slashing of operators on source chains. The function compares incompatible hash formats that are guaranteed to mismatch, lacks time-bound restrictions, ignores the global isChallengeEnabled flag, and has no protection against repeated slashing of the same task.

Vulnerability Details

Root Cause Analysis

denniswon

Security Report: Cross-Chain Challenge Slashing Vulnerability

Executive Summary

A critical vulnerability exists in the slashForCrossChainChallenge function of ChallengeVerifier.sol that allows arbitrary slashing of operators on the source chain. The function fails to bind the ZK proof's public values to the caller-supplied inputs and accepts an unverified non-signer list, enabling attackers to slash any chosen operator set without legitimate grounds.

Vulnerability Details

Location

denniswon

https://linear.app/magiclabs/issue/NEWT-710/support-flexible-identity-data-schemas-beyond-kyc

⏺ I now have the complete data flow mapped. Let me summarize what I've found and present the implementation plan.

  ★ Insight ─────────────────────────────────────
  The full identity data flow has 6 touchpoints that need updating:
  1. Gateway RPC (identity.rs types) — already domain-aware (identity_domain: FixedBytes<32>)
  2. Gateway data provider (data_provider.rs) — encrypt_identity_data() takes typed IdentityData (needs to become domain-agnostic)
  3. chainio (identity_data.rs) — IdentityData sol struct (8 KYC fields), fetch_identity_data() returns opaque String,
  EncryptedIdentityData (single string data)

denniswon

 Here's my complete analysis:

  Part 1: Why blocknumber - 1 Exists

  The BLS verification chain requires this:

  Gateway                         Contract (createTask)              Contract (validateAttestationDirect)
     │                                    │                                    │
     │ current_block = 10433577           │                                    │
     │ task_created_block = 10433576      │                                    │

denniswon

# Recall MCP — Self-Hosted Setup Guide

Self-hosted Recall MCP for Claude Code using Upstash Redis (cloud) and the open-source `@joseairosa/recall` NPM package. No local Redis, no Docker, no subscription.

Source: https://github.com/joseairosa/recall

---

## Prerequisites

denniswon

 ---
  Rhinestone Chain Abstraction (Warp) — Technical Summary

  What It Is

  Rhinestone Warp is an intent-based cross-chain execution engine built on ERC-7579 smart account modules. Users express desired outcomes ("send 100 USDC
  from Optimism to Base and deposit into a vault"), and a competitive solver/relayer market fulfills them — handling bridging, swapping, and gas
  abstraction transparently.

  ★ Insight ─────────────────────────────────────

denniswon

 ---
  Viem vs Newton SDK — Architecture Comparison

  Where Newton SDK Already Aligns with Viem

  ┌────────────────────┬────────────────────────┬──────────────────────────────────────┬───────────┐
  │        Area        │          Viem          │              Newton SDK              │  Status   │
  ├────────────────────┼────────────────────────┼──────────────────────────────────────┼───────────┤
  │ Linter/Formatter   │ Biome                  │ Biome 1.9.4                          │ Already   │
  │                    │                        │                                      │ aligned   │